Web App Security for Java Developers - PWX 2021

Web app security is not just authentication and authorization. It's also the things you do to protect your web app from attackers with their XSS (cross-site scripting), SQL injection, DoS/DDoS attacks, and CSRF (cross-site request forgery), to name a few.

Web app security is a central component of any web-based business. The internet exposes web apps to attacks from different locations and various levels of scale and complexity. Web application security deals specifically with the security surrounding websites, web applications, and web services such as APIs.

In this presentation, you'll learn seven ways to better web app security, using Spring Security for code samples. You'll also see some quick demos of Spring Boot, Angular, and JHipster with Keycloak, Auth0, and Okta.

Transcript

1. Matt Raible | @mraible
   December 7, 2021
   Web App
   Security for
   
   
   Java Developers
   Photo by Michiel Leunens on https://unsplash.com/photos/fBB7FeS4Xas
   

   View Slide

2. @mraible
   Who is Matt Raible?
   Father, Husband, Skier, Mountain
   Biker, Whitewater Rafter
   
   
   Bus Lover
   
   
   Web Developer and Java Champion
   
   
   Okta Developer Advocate
   
   
   Blogger on raibledesigns.com and
   developer.okta.com/blog
   @mraible
   

   View Slide

3. View Slide

4. View Slide

5. View Slide

6. developer.okta.com
   

   View Slide

7. @mraible
   Today’s Agenda
   What is web app security?
   
   
   7 simple ways to better app security
   
   
   3 quick demos
   
   
   🍃 Spring Boot
   
   
   🅰 Angular
   
   
   🤓 JHipster
   

   View Slide

8. What is web app security?
   

   View Slide

9. 1. Use HTTPS
   
   
   2. Scan your dependencies
   
   
   3. Use the latest releases
   
   
   4. Secure your secrets
   7 Simple Ways to Better Web App Security
   5. Use a Content Security Policy
   
   
   6. Use OAuth 2.0 and OIDC
   
   
   7. Prevent Cross-site request
   forgery (CSRF)
   
   
   

   View Slide

10. @mraible
    1. Use HTTPS Everywhere!
    Let’s Encrypt offers free HTTPS certificates
    
    
    certbot can be used to generate certificates
    
    
    mkcert can be used to create localhost certificates
    
    
    Spring Boot Starter ACME for automating certificates
    
    
    

    View Slide

11. What is HTTPS?
    https://howhttps.works
    

    View Slide

12. How HTTPS Works
    https://howhttps.works
    

    View Slide

13. HTTPS for Static Sites too!
    https://www.troyhunt.com/heres-why-your-static-website-needs-https
    

    View Slide

14. HTTPS is Easy!
    

    View Slide

15. Force HTTPS in Spring Boot
    @Configuration
    
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    @Override
    
    protected void configure(HttpSecurity http) throws Exception {
    
    http.requiresChannel().anyRequest().requiresSecure();
    
    }
    
    }
    

    View Slide

16. Force HTTPS in the Cloud
    @Configuration
    
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    @Override
    
    protected void configure(HttpSecurity http) throws Exception {
    
    http.requiresChannel()
    
    .requestMatchers(r
    ->
    r.getHeader("X-Forwarded-Proto")
    !=
    null)
    
    .requiresSecure();
    
    }
    
    }
    

    View Slide

17. Force HTTPS in Spring WebFlux
    @EnableWebFluxSecurity
    
    public class SecurityConfiguration {
    
    @Bean
    
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    
    http.redirectToHttps(withDefaults());
    
    return http.build();
    
    }
    
    }
    

    View Slide

18. Force HTTPS in Spring WebFlux + Cloud
    @EnableWebFluxSecurity
    
    public class SecurityConfiguration {
    
    @Bean
    
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    
    http.redirectToHttps(redirect
    ->
    redirect
    
    .httpsRedirectWhen(e
    ->
    
    
    e.getRequest().getHeaders().containsKey("X-Forwarded-Proto"))
    
    );
    
    return http.build();
    
    }
    
    }
    

    View Slide

19. @mraible
    “Why do we need HTTPS
    
    
    inside our network?”
    

    View Slide

20. @mraible
    2. Scan Your Dependencies
    

    View Slide

21. @mraible
    GitHub + Dependabot
    

    View Slide

22. @mraible
    Full-featured Dependency Scanners
    

    View Slide

23. 3. Use the Latest Releases
    

    View Slide

24. How well do you know your dependencies?
    Dependency
    Health
    Indirect
    Dependencies
    Regular
    Releases
    Regular
    commits
    Dependencies
    

    View Slide

25. Check for Updates with npm
    npm i -g npm-check-updates
    
    ncu
    

    View Slide

26. Check for Updates with Maven
    mvn versions:display-dependency-updates
    
    https://www.mojohaus.org/versions-maven-plugin
    

    View Slide

27. Check for Updates with Gradle
    plugins {
    
    id("se.patrikerdes.use-latest-versions") version "0.2.17"
    
    id("com.github.ben-manes.versions") version "0.39.0"
    
    ...
    
    
    }
    $ ./gradlew useLatestVersions
    https://github.com/patrikerdes/gradle-use-latest-versions-plugin
    

    View Slide

28. @mraible
    4. Secure Your Secrets
    

    View Slide

29. HashiCorp Vault and Azure Key Vault
    

    View Slide

30. https://developer.okta.com/blog/2020/05/04/spring-vault
    Secure Secrets With Spring Cloud Config and Vault
    

    View Slide

31. 5. Use a Content Security Policy
    

    View Slide

32. Default Spring Security Headers
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    
    Pragma: no-cache
    
    Expires: 0
    
    X-Content-Type-Options: nosniff
    
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    
    X-Frame-Options: DENY
    
    X-XSS-Protection: 1; mode=block
    

    View Slide

33. Add a Content Security Policy with Spring Security
    @EnableWebSecurity
    
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    @Override
    
    protected void configure(HttpSecurity http) throws Exception {
    
    http.headers()
    
    .contentSecurityPolicy("script-src 'self' " +
    
    "https:
    //
    trustedscripts.example.com; " +
    
    "object-src https:
    //
    trustedplugins.example.com; " +
    
    "report-uri /csp-report-endpoint/");
    
    }
    
    }
    

    View Slide

34. Test Your Security Headers
    https://securityheaders.com
    

    View Slide

35. @mraible
    6. Use OAuth 2.0 and OpenID Connect
    OpenID Connect
    OAuth 2.0
    HTTP
    OpenID Connect is for
    authentication
    
    
    

    OAuth 2.0 is for authorization
    

    View Slide

36. @mraible
    Authorization Code Flow Example
    https://developer.okta.com/blog/2019/08/28/reactive-microservices-spring-cloud-gateway
    

    View Slide

37. @mraible
    Does OAuth 2.0 feel like a maze of specs?
    https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
    

    View Slide

38. @mraible
    OAuth 2.1 to the rescue!
    https://oauth.net/2.1
    PKCE is required for all clients using the authorization code flow
    
    
    Redirect URIs must be compared using exact string matching
    
    
    The Implicit grant is omitted from this specification
    
    
    The Resource Owner Password Credentials grant is omitted from this specification
    
    
    Bearer token usage omits the use of bearer tokens in the query string of URIs
    
    
    Refresh tokens for public clients must either be sender-constrained or one-time use
    

    View Slide

39. 7. Prevent CSRF Attacks
    

    View Slide

40. Configure CSRF Protection with Spring Security
    @EnableWebSecurity
    
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    @Override
    
    protected void configure(HttpSecurity http) throws Exception {
    
    http
    
    .csrf()
    
    .csrfTokenRepository(
    
    CookieCsrfTokenRepository.withHttpOnlyFalse());
    
    }
    
    }
    

    View Slide

41. SameSite Cookies
    

    View Slide

42. @mraible
    Demos!
    🍃 🅰 🤓
    

    View Slide

43. 1. Use HTTPS
    
    
    2. Scan your dependencies
    
    
    3. Use the latest releases
    
    
    4. Secure your secrets
    Recap: 7 Simple Ways to Better Web App Security
    5. Use a Content Security Policy
    
    
    6. Use OAuth 2.0 and OIDC
    
    
    7. Prevent Cross-site request
    forgery (CSRF)
    
    
    

    View Slide

44. developer.okta.com/blog
    
    
    @oktadev
    

    View Slide

45. Curious About Microservice Security?
    https://developer.okta.com/blog/2020/03/23/microservice-security-patterns
    

    View Slide

46. Or Auth Security Patterns?
    https://bit.ly/mraible-springone-2021
    
    
    https://youtu.be/CebTJ7Nq1Hs
    

    View Slide

47. Thanks!
    
    
    Keep in Touch
    
    
    raibledesigns.com
    
    
    @mraible
    
    
    Presentations
    
    
    speakerdeck.com/mraible
    
    
    Code
    
    
    github.com/oktadev
    developer.okta.com
    

    View Slide

48. developer.okta.com
    

    View Slide